我正在监视浏览器事件，例如创建新选项卡时。我的扩展需要在新标签页中显示这些浏览器事件。
为了使版本控制更容易，我希望扩展尽可能简单。也就是说，它所需要做的就是告诉我一个选项卡已创建，并且我需要能够告诉扩展程序切换到选项卡。这样我就不必担心人们安装了哪些扩展版本。
到目前为止，新的标签页是重定向到我的服务器上托管的单页应用程序。
我的选择似乎是：
-
使用自定义事件在内容脚本和嵌入页面之间发送消息：http://code.google.com/chrome/extensions/content_scripts.html#host-page-communication
这似乎存在安全风险，因为页面 javascript 也可以访问 DOM，从而访问我正在交换的消息。
-
将 HTML 从服务器加载到 iframe 中，从服务器中提取应用程序 JS 并将其作为内容脚本注入到 iframe 中。这使得应用程序的 JS 能够完全访问我所需要的 chrome 扩展 API。
另一个考虑因素是我的项目当前正在使用 RequireJS。对于选项2，我似乎无法使用它。
任何人都可以推荐首选选项，同时牢记选项 1 的安全风险吗？
我可以将 RequireJS 与选项 2 一起使用吗？
是否有其他方法可以实现这个？
I am monitoring browser events such as when a new tab is created. My extension needs to display these browser events in the new tab page.
To make versioning easier I would like the extension to be as dumb as possible. That is, all it needs to do is tell me is that a tab has been created and I need to be able to tell the extension to switch to a tab. Then I do not have to worry about what extension versions people have installed.
The new tab page so far is a redirect to my single-page app hosted on my server.
My options seem to be:
-
Using custom events to send messages between the content script and embedding page: http://code.google.com/chrome/extensions/content_scripts.html#host-page-communication
This seems like a security risk as the page javascript will also have access to the DOM and hence the messages I am exchanging.
-
Loading the HTML from server into an iframe, pulling application JS from server and injecting it into the iframe as a contentscript. This allows the app's JS to have full access to the chrome extension API which is what I need.
Another consideration is that my project is currently using RequireJS. For option 2, it seems I won't be able to use this.
Can anyone recommend the preferred option keeping in mind the security risks of option 1?
Will I be able to use RequireJS with option 2?
Is there another way to acheive this?
发布评论